Security | Easel.sh

Understand how Easel protects deployments, traffic, workspaces, and application data.

Easel protects every deployment with always-on platform protections and gives you additional controls for managing application traffic and access.

Security on Easel has four layers:

Platform protections identify and mitigate malicious or abusive traffic automatically.
Firewall controls let you log, block, challenge, redirect, or bypass Attack Mode for requests using project-specific rules.
Access protection (Deployment Protection) controls who may access previews and other non-public deployments.
Workspace security controls access to projects, settings, secrets, and production operations.

These layers complement application-level security. Your application remains responsible for authentication, authorization, input validation, session management, and secure use of external services.

How requests are protected

A request may pass through several security layers before reaching your application:

Internet
   ↓
Platform protections
   ↓
Deployment protection
   ↓
Custom firewall rules
   ↓
Attack Mode
   ↓
CDN, routing, and cache
   ↓
Static assets or functions

The exact evaluation order matters because an earlier decision may prevent later layers or application code from running.

See Security evaluation order.

Platform protections

Platform protections are operated by Easel and apply automatically.

They are designed to detect and mitigate:

Network and application-layer attacks
Request floods
Known malicious or abusive sources
Automated scanning and exploit attempts
Suspicious traffic patterns
Traffic intended to exhaust application resources

Platform protections do not require project-specific rules.

See Platform protections.

Firewall controls

The Easel Firewall lets you define project-specific traffic rules. Start with WAF rules for an overview, then configure detailed rules under Firewall, Custom rules, and IP rules.

Rules can evaluate request properties such as:

Path
Method
IP address
Country and ASN
Header
User agent
Hostname
Environment

A matching rule can log, deny, challenge, redirect, or bypass Attack Mode, depending on the action you choose.

See Firewall and Custom rules.

Attack Mode

Attack Mode places an additional browser verification step in front of a project during an active attack or sudden surge in abusive traffic.

It is intended as an emergency control, not as a replacement for application authentication or carefully scoped firewall rules.

See Attack Mode.

Access protection controls who can open a deployment before application code runs. Easel provides this through Deployment Protection for Preview deployments, branch URLs, unique deployment URLs, and other non-current deployments.

These controls are separate from the firewall:

The firewall determines whether traffic is permitted at the request layer.
Deployment protection determines whether the requester is authorized to access the deployment.

See Access protection.

Security observability

Security decisions appear alongside ordinary request activity.

You can use firewall events and request details to determine:

Which action Easel took
Which rule matched
Whether the request reached application code
Whether the request was challenged
Which project and deployment received the request

See Firewall observability.

Shared responsibility

Easel secures the deployment platform and provides traffic and access controls. You remain responsible for the security of your application and data.

See Shared responsibility.

On this page